feat: 固定 Database 凭据位置与确认版本

2026-09-27 18:08:09 +00:00
parent 6b2808ce91
commit 371248659b
13 changed files with 323 additions and 20 deletions
@@ -0,0 +1,47 @@
+//go:build integration
+
+package openbao_test
+
+import (
+	"maps"
+	"testing"
+
+	bao "github.com/openbao/openbao/api/v2"
+
+	"git.ddupan.top/panxiao81/ayatori/internal/database/adapter/openbao"
+)
+
+func TestConfirmedCredentialRecoveryWithRealOpenBao(t *testing.T) {
+	root := baoFixture(t)
+	store := fixtureStore(t, root)
+	credential := fixtureCredential(t)
+	if err := store.Create(t.Context(), credentialPath, credential); err != nil {
+		t.Fatal(err)
+	}
+	// 新 adapter 模拟进程重启：只有已持久化的版本才能恢复读取。
+	restarted := fixtureStore(t, root)
+	if _, err := restarted.ReadConfirmed(t.Context(), credentialPath, 0); err != openbao.ErrConflict {
+		t.Fatal("已有值不能替代缺失的确认记录")
+	}
+	observed, err := restarted.ReadConfirmed(t.Context(), credentialPath, 1)
+	if err != nil || !maps.Equal(observed.SecretData(), credential.SecretData()) {
+		t.Fatal("确认版本的凭据不能恢复读取")
+	}
+	// 即使内容相同，新增版本也不属于已确认写入；历史版本仍在不能掩盖改写。
+	if _, err := root.KVv2("secret").Put(t.Context(), credentialPath, credential.SecretData(), bao.WithCheckAndSet(1)); err != nil {
+		t.Fatal("无法准备测试中的版本变化")
+	}
+	if _, err := restarted.ReadConfirmed(t.Context(), credentialPath, 1); err != openbao.ErrConflict {
+		t.Fatal("最新版本漂移必须报冲突")
+	}
+	if err := root.KVv2("secret").Delete(t.Context(), credentialPath); err != nil {
+		t.Fatal("无法准备测试中的软删除")
+	}
+	if _, err := restarted.ReadConfirmed(t.Context(), credentialPath, 1); err != openbao.ErrConflict {
+		t.Fatal("已确认凭据被删除必须报冲突")
+	}
+	metadata, err := root.KVv2("secret").GetMetadata(t.Context(), credentialPath)
+	if err != nil || metadata.CurrentVersion != 2 {
+		t.Fatal("恢复检查不得生成或覆盖凭据")
+	}
+}